first shot of malware classification
deralexxx
parent
723e81c0a2
commit
015194e09b
|
|
@ -0,0 +1,82 @@
|
|||
# Malware Classification
|
||||
|
||||
## Malware Categories
|
||||
|
||||
All malware samples should be classified into one of the categories listed in the table below.
|
||||
|
||||
<dl>
|
||||
<dt>Virus</dt>
|
||||
<dd><dd>
|
||||
|
||||
<dt>Worm</dt>
|
||||
<dd><dd>
|
||||
|
||||
<dt>Trojan</dt>
|
||||
<dd><dd>
|
||||
|
||||
<dt>Ransomware</dt>
|
||||
<dd><dd>
|
||||
|
||||
<dt>Rootkit</dt>
|
||||
<dd><dd>
|
||||
|
||||
<dt>Downloader</dt>
|
||||
<dd><dd>
|
||||
|
||||
<dt>Adware</dt>
|
||||
<dd><dd>
|
||||
|
||||
<dt>Spyware</dt>
|
||||
<dd><dd>
|
||||
|
||||
</dl>
|
||||
|
||||
## Obfuscation Classification
|
||||
|
||||
All malware samples should be classified into one of the categories listed in the table below.
|
||||
|
||||
<dl>
|
||||
<dt>no-obfuscation</dt>
|
||||
<dd>No obfuscation is used<dd>
|
||||
<dt>encryption</dt>
|
||||
<dd>encryption<dd>
|
||||
<dt>oligomorphism</dt>
|
||||
<dd>oligomorphism<dd>
|
||||
<dt>metamorphism</dt>
|
||||
<dd>metamorphism<dd>
|
||||
<dt>stealth</dt>
|
||||
<dd>stealth<dd>
|
||||
<dt>armouring</dt>
|
||||
<dd>armouring<dd>
|
||||
<dt>encryption</dt>
|
||||
<dd>encryption<dd>
|
||||
<dt>tunneling</dt>
|
||||
<dd>tunneling<dd>
|
||||
<dt>XOR</dt>
|
||||
<dd>XOR<dd>
|
||||
<dt>BASE64</dt>
|
||||
<dd>BASE64<dd>
|
||||
<dt>ROT13</dt>
|
||||
<dd>ROT13<dd>
|
||||
</dl>
|
||||
## Payload Classification
|
||||
|
||||
|
||||
## Memory Classification
|
||||
|
||||
|
||||
# Machine-parsable Malware Classification
|
||||
|
||||
The repository contains a [JSON file including the machine-parsable tags](machinetag.json)
|
||||
along with their human-readable description. The software can use both
|
||||
representation on the user-interface and store the tag as machine-parsable.
|
||||
|
||||
~~~~
|
||||
malware_classification:malware-category="virus"
|
||||
~~~~
|
||||
|
||||
Based on:
|
||||
|
||||
https://www.sans.org/reading-room/whitepapers/incident/malware-101-viruses-32848
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,162 @@
|
|||
{
|
||||
"namespace": "malware_classification",
|
||||
"description": "Classification based on different categories. Based on https://www.sans.org/reading-room/whitepapers/incident/malware-101-viruses-32848",
|
||||
"version": 1,
|
||||
"predicates": [
|
||||
{
|
||||
"value": "malware-category",
|
||||
"expanded": "Malware Category"
|
||||
},
|
||||
{
|
||||
"value": "obfuscation-technique",
|
||||
"expanded": "Obfuscation Technique"
|
||||
},
|
||||
{
|
||||
"value": "payload-classification",
|
||||
"expanded": "Payload Classification"
|
||||
},
|
||||
{
|
||||
"value": "memory-classification",
|
||||
"expanded": "Memory Classification"
|
||||
}
|
||||
],
|
||||
"values": [
|
||||
{
|
||||
"predicate": "malware-category",
|
||||
"entry": [
|
||||
{
|
||||
"value": "Virus",
|
||||
"expanded": "Virus"
|
||||
},
|
||||
{
|
||||
"value": "Worm",
|
||||
"expanded": "Worm"
|
||||
},
|
||||
{
|
||||
"value": "Trojan",
|
||||
"expanded": "Trojan"
|
||||
},
|
||||
{
|
||||
"value": "Ransomware",
|
||||
"expanded": "Ransomware"
|
||||
},
|
||||
{
|
||||
"value": "Rootkit",
|
||||
"expanded": "Rootkit"
|
||||
},
|
||||
{
|
||||
"value": "Downloader",
|
||||
"expanded": "Downloader"
|
||||
},
|
||||
{
|
||||
"value": "Adware",
|
||||
"expanded": "Adware"
|
||||
},
|
||||
{
|
||||
"value": "Spyware",
|
||||
"expanded": "Spyware"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"predicate": "obfuscation-technique",
|
||||
"entry": [
|
||||
{
|
||||
"value": "no-obfuscation",
|
||||
"expanded": "No obfuscation is used"
|
||||
},
|
||||
{
|
||||
"value": "encryption",
|
||||
"expanded": "encryption"
|
||||
},
|
||||
{
|
||||
"value": "oligomorphism",
|
||||
"expanded": "oligomorphism"
|
||||
},
|
||||
{
|
||||
"value": "metamorphism",
|
||||
"expanded": "metamorphism"
|
||||
},
|
||||
{
|
||||
"value": "stealth",
|
||||
"expanded": "stealth"
|
||||
},
|
||||
{
|
||||
"value": "armouring",
|
||||
"expanded": "armouring"
|
||||
},
|
||||
{
|
||||
"value": "encryption",
|
||||
"expanded": "encryption"
|
||||
},
|
||||
{
|
||||
"value": "tunneling",
|
||||
"expanded": "tunneling"
|
||||
},
|
||||
{
|
||||
"value": "XOR",
|
||||
"expanded": "XOR"
|
||||
},
|
||||
{
|
||||
"value": "BASE64",
|
||||
"expanded": "BASE64"
|
||||
},
|
||||
{
|
||||
"value": "ROT13",
|
||||
"expanded": "ROT13"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"predicate": "payload-classification",
|
||||
"entry": [
|
||||
{
|
||||
"value": "no-payload",
|
||||
"expanded": "No payload"
|
||||
},
|
||||
{
|
||||
"value": "non-destructive",
|
||||
"expanded": "Non-Destructive"
|
||||
},
|
||||
{
|
||||
"value": "destructive",
|
||||
"expanded": "Destructive"
|
||||
},
|
||||
{
|
||||
"value": "dropper",
|
||||
"expanded": "Dropper"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"predicate": "memory-classification",
|
||||
"entry": [
|
||||
{
|
||||
"value": "resident",
|
||||
"expanded": "In memory"
|
||||
},
|
||||
{
|
||||
"value": "temporary-resident",
|
||||
"expanded": "In memory temporarily"
|
||||
},
|
||||
{
|
||||
"value": "swapping-mode",
|
||||
"expanded": "Only a part loaded in memory temporarily"
|
||||
},
|
||||
{
|
||||
"value": "non-resident",
|
||||
"expanded": "Not in memory"
|
||||
},
|
||||
{
|
||||
"value": "user-process",
|
||||
"expanded": "As a user level process"
|
||||
},
|
||||
{
|
||||
"value": "kernel-process",
|
||||
"expanded": "As a process in the kernel"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue